News

Vulnerability-Lookup 6.4.0 released

We are pleased to announce the release of Vulnerability-Lookup 6.4.0! The vulnerability timeline now measures what it shows: time to exploit, time to patch, time unpatched, exploitation to patch and more, computed from the dated evidence the instance holds and aligned with the Vulnerability Timeline and Exposure Metrics (VTEM). The CWE catalogue moves to CWE 5.0 and its schema 8, groupings and views included. The statistics page opens with a comparison of the sources by the records they hold, and the record counts gain a currently-published basis that leaves withdrawn records out. Also in this release: a dump of the identifier correlations, a credits API, a way to switch off a KEV catalogue an instance does not import, a much lighter CERT-FR feeder, and Python 3.15 support.

November 5, 2026

Vulnerability Report - October 2026

All vulnerability reports Introduction This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform’s community.

November 4, 2026

Leakage-Free Splits and Consistent CVSS 4.0 Scoring for the VLAI Severity Classifiers

Read the technical report as a PDF. We are publishing a new version of CIRCL/vulnerability-scores, the dataset behind the VLAI vulnerability severity classifiers used in Vulnerability-Lookup. The new version gives the models a stricter, more reliable evaluation and more consistent severity labels. A technical report describes the changes and the measurements behind them.

October 29, 2026

3.5 Years of Vulnerability-Lookup in Under 3 Minutes

I turned the Git history of Vulnerability-Lookup into a Gource visualization. Every dot is a file, every beam is a contributor at work, and the tree grows as the project evolves. There should have been a video here but your browser does not seem to support it. A few milestones you’ll spot in the video 📅 10 April 2023: first commit, simply titled “initial repo” 🚀 19 June 2024: v1.0.0 🔁 18 October 2024: v2.0.0 🤖 26 January 2026: first Claude-assisted commit, introducing a user-managed KEV catalogue compliant with GCVE BCP-07 🏷️ 14 October 2026: v6.3.0, our 57th release A few numbers: 3,435 commits, 32 contributors, and more than 90 vulnerability sources.

October 16, 2026

Vulnerability-Lookup 6.3.0 released

We are pleased to announce the release of Vulnerability-Lookup 6.3.0! This is a large release. Two new scorecards grade the actors of the vulnerability ecosystem on what they publish: the CNA and GNA scorecard ranks assigners on the quality of their records, and the KEV catalogue scorecard ranks the known-exploited-vulnerability catalogues on how they back, situate, lead and maintain their assertions. The vulnerability page gains a timeline of everything dated the instance holds on a record, and the sighting correlation graphs are redrawn with Pivotick. Vulnerability-Lookup reads and renders GCVE-BCP-05-X-03, the handling and disclosure timeline extension, and corroborates its exploitation events with the KEV catalogues and the sightings it holds. CNAs publishing through the platform get an immutable publication audit history. The exploit hazard aggregates are corrected for the Weibull model. Also in this release: single sign-on through OpenID Connect, a bulk lookup endpoint, GCVE-0 identifiers accepted everywhere, a syntax-highlighting detection rules viewer, a statistics page that can finally draw every figure the API serves, and richer /recent feeds.

October 14, 2026

Vulnerability Report - September 2026

October 2, 2026

Vulnerability-Lookup 6.2.0 released

We are pleased to announce the release of Vulnerability-Lookup 6.2.0! This release is centred on the KEV catalogs. A producer can now withdraw one of its own assertions, as GCVE BCP-07 2.3 specifies, and the withdrawal propagates to the mirrors instead of vanishing. The KEV catalogs page gains three cards that read what the listings rest on: the evidence behind them, the profile of the vulnerabilities they list, and their weekly trends. An organization page now tells what an organization is affected by, published as a GNA and assigned as a CNA, and the dashboard gets an Other sources tab covering every feed outside the CVE and GCVE programs. Also in this release: similarity searches over the ATT&CK bi-encoder, a Prometheus endpoint, the amended GCVE-BCP-05 identifier placement, BCP-03 static feeds, a site notice, three new OSV sources and a generated OpenAPI snapshot.

September 18, 2026

What Do KEV Catalogs Actually Know? Evidence, Lead Time and Zero-Days Across Five Catalogs

A Known Exploited Vulnerabilities (KEV) catalog is a list of vulnerabilities somebody asserts are being exploited in the wild. CISA publishes the best-known one. Vulnerability-Lookup aggregates five of them on its public instance — CISA KEV, the ENISA catalog, The Shadowserver Foundation’s honeypot observations, Previdian’s aggregation, and CIRCL’s own catalog — all expressed in the same GCVE BCP-07 format, so that they can be compared rather than merely browsed. Since June, the KEV catalogs page has shown which catalog lists which vulnerability. This post is about two new sections that answer the next two questions: why does a catalog say a vulnerability is exploited, and when does it say so relative to everything else we know about the vulnerability? Along the way they surface a population that is easy to overlook: vulnerabilities listed as exploited before their CVE was even published.

September 13, 2026

Vulnerability Report - August 2026

September 6, 2026

Vulnerability-Lookup 6.1.0 released

We are pleased to announce the release of Vulnerability-Lookup 6.1.0! This release brings a native EUVD API: an instance now exposes the EUVD identifiers it allocates through its own /api/euvd namespace, with listing, lookup by any correlated alias, advisory mapping, and a search endpoint that pages over the whole corpus. The CVE Program hierarchy arrives on the website as CNA roots — a root: search operator, a new dashboard tab and per-root feeds. A CPE-Editor instance can be plugged into the vulnerability page, the frontend libraries are now managed with npm, and administrators get an activity report of their local CNA/GNA over any date range. On top of that: sighting summaries on bundles, a Markdown export of the recent vulnerabilities, the CVE Program’s bundle warning, a storage fix that matters to every instance running on a modest host, and a batch of security fixes.

September 2, 2026

Next 2/9